Secure network architectures with monitoring systems configured to detect hackers.
Monitoring equipment such as network xe2x80x9csniffersxe2x80x9d, protocol analyzers, intrusion detection systems, network forensics systems, or other network analysis systems can be connected to data networks to monitor for intrusion, hackers, or other types of network problems. By connecting such equipment to a network, however, there is a danger that the security of the monitoring equipment itself can become compromised. In other words, there is a danger that a hacker could detect the existence of the monitoring equipment and jam or otherwise control or disrupt the operation of that equipment.
Described in this application is a system and device in which taps, which mirror or provide a copy of network traffic, are connected to monitoring equipment through shadowing units. The shadowing units allow inbound traffic from the first network to be passed, substantially unaltered, to the monitoring equipment, but block outbound transmissions from the monitoring equipment side of the shadowing units.
The shadowing units are connected through bypass switches, which allow the signals to either pass through an aggregation/dissemination unit to one or more monitoring units, or directly to the monitoring units. The selective bypassing allows the traffic that must be handled by the aggregation/dissemination unit to be controlled to account for traffic load or other variables.